# zodiac

| Info     | Details             |
| -------- | ------------------- |
| Category | Forensics / Network |

## Challenge Overview

> In this challenge we should find the location of Zodiac Killer using a `.pcap` file.\
> I firstly see some weird values in a UDP packet in this format – `Timestamp:Coordinates:Left clicked:Right clicked`.\
> Since we're talking about USB Mouse connection, I assumed that the coordinates represent the current mouse position.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2FNnijlS7w9lKhcJce9DLA%2FScreenshot_2.png?alt=media&#x26;token=dfa24481-105d-47f2-a79a-2a7eb33a3cf0" alt=""><figcaption><p>discovering weird values</p></figcaption></figure>

Then I used data exfiltration in order to get all the packets which contain that type of values.

<figure><img src="https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2F8o2N6kbs9iXa2dKXr0ZZ%2FScreenshot_1.png?alt=media&#x26;token=c96ed6cd-4636-42b9-89fc-f0a7cdc2a6e1" alt=""><figcaption><p>data exfil</p></figcaption></figure>

\
I extracted all coordinates with the **Left Click** set on `True` using the following script:

```python
import re

with open("sample.pcap", "rb") as f:
    data = f.read()

pattern = re.compile(rb"(\d+\.\d+),(\d+),(\d+),True,False")

# Extract coordinates only when left click is True
matches = pattern.findall(data)

with open("left_click_coordinates.txt", "w") as out:
    for match in matches:
        x = match[1].decode()
        y = match[2].decode()
        out.write(f"{x},{y}\n")
```

Using the extracted coordinates and the `PIL` library, I reconstructed the image drawn by the Zodiac Killer:

```python
from PIL import Image, ImageDraw
import pandas as pd

# Load the coordinates
df = pd.read_csv("left_click_coordinates.txt", header=None, names=["x", "y"])

# Set canvas size
width, height = 1200, 800
image = Image.new("RGB", (width, height), "white")
draw = ImageDraw.Draw(image)

# Draw points
for x, y in df.values:
    draw.point((x, y), fill="black")

image.save("output.png")
image.show()
```

## Final Flag

![](https://3350216265-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8aLNxke1qPtepwlrf6VI%2Fuploads%2Fpqkh5RisyGAUF3HCMuHg%2Fb8390a5b-2594-4f22-88b2-aec5cdd8c502.png?alt=media\&token=7afe11ab-ec79-453b-94d7-cc54202bed19)

`ctf{secretplacewukong'sden}`

*made by k0d*
